SafeDrain

Real SafeDrain session — repository audit

[Certain] The published v1.0.0 release still describes itself as unreleased. The bounded audit otherwise found all tracked files present, all checked local file references resolving, and no credential indicators.

[Certain]

Original task: “Perform a real, read-only directory and repository audit suitable for inclusion as a public example session on Agensi.” Target: rza255/safedrain, release v1.0.0. Required checks covered inventory, missing or large files, skill/license/release documentation, local references, credential indicators, and unchanged repository state. No fixes or publication were requested.

[Certain]

Actual environment: Codex desktop on Windows, OS description Microsoft Windows 10.0.26200; PowerShell 7.6.5; Git 2.56.0.windows.2; ripgrep 15.2.0. Execution date: 15 October 2026, Europe/Paris. A new isolated temporary clone was used. Below, $AUDIT and $SKILL replace personal absolute paths; command excerpts preserve the actual operations.

[Certain]

SafeDrain activation evidence: The agent explicitly invoked $safe-drain and loaded the installed plugin cache’s safe-drain/1.0.0/skills/safe-drain/SKILL.md using Get-Content -LiteralPath. Its SHA-256 was:

FE07DF0E8ED17AAFA1B9F2A9DABF14F44138CBA2025E531B5267F09E88C97159

[Certain] The loaded file was 7,186 bytes; the release’s skill was 7,036 bytes. A direct comparison after CRLF/LF normalization returned EqualAfterNewlineNormalization: true. Activation evidence consists of the file read and the applied policy decisions; no automatic activation event was observed.

[Certain] Native mcp__codex_app__get_usage_limits returned ordinaryUsageAllowed: true and a codex limit bucket with 300-minute and 10,080-minute windows. All readings below came from actual calls. Remaining percentages are calculated as 100 minus native usedPercent.

[Certain] Policy thresholds were evaluated independently: 5h CAUTION ≤25%, DRAIN ≤20%, HARD DRAIN ≤15%; weekly CAUTION ≤5%, DRAIN ≤3%, HARD DRAIN ≤2%. The most restrictive triggered state would govern. Neither window triggered a threshold in any observed reading.

[Guessing] Admission estimates allowed up to 3 percentage points of 5h quota and 1 weekly point for the audit, with recovery reserves of 2 and 1 points. Recent burn was initially unknown, so release verification was followed by a fresh reading. Later observed intervals changed by 0–1 point in the 5h window and 0 weekly points. Retaining checks after each bounded batch left the projected next unit above CAUTION and preserved the reserves. These were conservative planning judgments, not measured operation costs.

[Certain] Repository identity and release evidence — command/output excerpts:

git ls-remote --exit-code https://github.com/rza255/safedrain.git 'refs/tags/v1.0.0' 'refs/tags/v1.0.0^{}'
git -c credential.helper= -c core.autocrlf=false clone --depth 1 --branch v1.0.0 --single-branch https://github.com/rza255/safedrain.git "$AUDIT/repo"
git remote get-url origin
git rev-parse HEAD
git rev-parse 'refs/tags/v1.0.0^{commit}'

a87c6fab19271c7fc9c5d284c26731bb8abbe9b0  refs/tags/v1.0.0
71d5a22a43d308e8d922e7e15cce29de3ba4d9b1  refs/tags/v1.0.0^{}
https://github.com/rza255/safedrain.git
71d5a22a43d308e8d922e7e15cce29de3ba4d9b1
71d5a22a43d308e8d922e7e15cce29de3ba4d9b1

[Certain] Git checked out detached HEAD at the annotated tag’s peeled commit. The public GitHub release API was also read with Invoke-RestMethod:

{
  "html_url": "https://github.com/rza255/safedrain/releases/tag/v1.0.0",
  "tag_name": "v1.0.0",
  "name": "SafeDrain v1.0.0",
  "draft": false,
  "prerelease": false,
  "published_at": "2026-09-29T17:21:34Z",
  "target_commitish": "71d5a22a43d308e8d922e7e15cce29de3ba4d9b1"
}

[Certain]

Inventory: git ls-files --stage, Get-Item, and Get-FileHash -Algorithm SHA256 identified eight tracked regular files, totaling 1,080,874 bytes:

[Certain] No tracked file was missing or empty; none exceeded 1 MiB. The only file above the separate 512 KiB review cutoff was the documented branding PNG. Its signature was 89-50-4E-47-0D-0A-1A-0A, and its IHDR dimensions were 1,254 × 1,254, matching README.md:300–303. This header check did not perform a full image decode. The expected directories were assets/, docs/, and skills/safe-drain/. The skill, MIT license, changelog, README, validation notes, and submission scenarios were present.

[Certain]

Reference and credential checks: A saved PowerShell audit script used native filesystem commands, regular expressions, Select-String, and JSON manifest parsing. It checked six relative Markdown file links and both manifest image fields:

README.md:221                 docs/VALIDATION.md        True
README.md:289                 docs/SUBMISSION_TESTS.md  True
README.md:300                 assets/safedrain.png      True
README.md:336                 LICENSE                   True
docs/SUBMISSION_TESTS.md:5     VALIDATION.md             True
docs/VALIDATION.md:453         SUBMISSION_TESTS.md       True
plugin.json logo              ./assets/safedrain.png     True
plugin.json composerIcon      ./assets/safedrain.png     True

[Certain] Results: MissingLocalReferences: 0, SensitiveFilenames: [], CredentialIndicatorHits: [], ContentScanFiles: 8. Patterns covered private-key headers, common provider token formats, quoted credential assignments, credential-bearing URLs, and sensitive filenames such as environment files, key stores, and credential files. Only hit locations and rule names would have been printed. Installation destinations and hypothetical test-workspace files such as HANDOFF.md were treated as contextual references.

[Certain] This was a bounded tracked-content scan; it did not certify the absence of every possible secret or inspect full Git history. External link availability and Markdown anchor correctness were outside the local-file check.

[Certain]

Finding — stale release documentation: README.md:14–18, CHANGELOG.md:3–12, and docs/VALIDATION.md:432,456–457 retain candidate/unreleased wording. The changelog says no tag or release has occurred, despite the verified published release. No repository files were changed.

[Certain] Final verification — commands and measured results:

git --no-optional-locks status --porcelain=v1 --untracked-files=all
git --no-optional-locks diff --exit-code
git --no-optional-locks diff --cached --exit-code
git fsck --no-reflogs

HashDifferences: 0
GitBlobMismatches: []
FinalStatusLines: 0
UnstagedDiffExit: 0
StagedDiffExit: 0
GitFsckExit: 0
HEAD: 71d5a22a43d308e8d922e7e15cce29de3ba4d9b1

[Certain] Every tracked file’s final SHA-256 matched its baseline; git hash-object --no-filters also matched each HEAD blob. A subsequent final status check again emitted no status lines.

[Certain]

Outcome: Audit completed with one release-documentation inconsistency and a clean working tree. Native remaining quota moved from 33% to 30% over 5 hours and stayed at 54% weekly. These shared-account readings cannot attribute consumption exclusively to this audit, and unchanged rounded percentages do not prove zero consumption. No threshold crossing, drain action, simulated activity, or deliberate quota consumption was used.

[Certain] The isolated checkout, loaded skill copy, audit script, hash inventories, reference results, GitHub release response, and private command/native-response records remain available locally for verification. Personal paths and account identifiers are omitted from this public transcript. Work stopped after the audit and evidence preparation.